How do I know what they found or viewed?

  • 6
    Confiscated by who? Makes a big difference. – Moab Jan 21 '11 at 3:43
  • +1, Surprised no one has up voted this yet, it is a great question. – Moab Jan 21 '11 at 3:45

If they did it the forensically correct way, then there is NO WAY to determine what was examined. The correct way would have been for the forensic tech to pull the hard drive out, clone it, return your hard drive to the machine and then examine the clone image. There will be no traces whatsoever on your drive since it was never booted. They will work strictly from the clone image and you should consider everything on the hard drive as having been compromised and you also should be aware they may have retained the image or parts of the image. Hope you didn't have anything on there you will regret.

  • 1
    Indeed, you must assume they have seen everything. (Possibly including files you had deleted.) Just consider yourself lucky that they returned the system... – SamB Jan 21 '11 at 3:18
  • 5
    Another reason for whole disc encryption using Trucrypt. – Moab Jan 21 '11 at 3:44
  • 4
    As for the TrueCrypt, yes, it should help. But if the attacker is that dedicated, they may also plant a modified TrueCrypt bootloader that will save the entered password, then send it to their server. If they have time to disassemble your laptop, they may even plant a hardware keylogger. Be paranoid, be very paranoid – Martheen Cahya Paulo Jan 21 '11 at 4:16
  • 2
    @typoknig : Pure bruteforce on a well implemented strong encryption would take years though. However, if there's weakness found later, the attack could made in shorter time period. As for now, I believe keylogging, hardware and or software, would be easier – Martheen Cahya Paulo Jan 21 '11 at 4:59
  • 2
    @Martheen Cahya Paulo I agree it could take years, but it really depends on the encryption level. TrueCrypt allows up to 256 bit encryption I believe, which would take a very long time (years) to decrypt, but the encryption < 128 bit might only take weeks to months (basing this off of my experience with the AES encryption used in WiFi networks). – ubiquibacon Jan 21 '11 at 5:08

You can use a script to recursively sort files on the system by last access time. However, with all of the activity constantly going on in the file system such as indexing, it is near impossible to determine exactly what they've looked at.

  • 1
    Is or isn't near impossible? – Wuffers Jan 21 '11 at 3:19
  • Is near impossible. My double negatives get the best of me sometimes :) – John T Jan 21 '11 at 3:29

The quickest way to view the time your files were last accessed, as far as I know:

  1. Download the search tool Everything: http://www.voidtools.com/

  2. Install it and run the program, and wait for it to index your disk (should take less than a minute)

  3. Richt-click on the column headers (where it says "date modified"), and enable "Last accessed"

  4. Now search for something random, like windows

  5. Click on the new column header "Last accessed" to sort search results, so that latest are on top

  6. Delete your old search, and search for *.*. This will take a long time, especially if this is the first time you use Everything; it could be up to 10 minutes, I don't know how long: that depends on your PC; just keep waiting, it took me 3 minutes on this old-ish PC

  7. Now you have a list of all the files on your PC, listed by the time they were last accessed, with dates and times.

Note that Windows also accesses some files when the PC is on without external output, so it you can't be sure it was they who accessed a file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.